REMARKS 

Claims 1 through 33 were presented for examination and were pending in this 
application. In an Office Action dated May 31, 2005, ("Office Action") claims 1 through 33 
were rejected. Applicant thanks Examiner for examination of the claims pending in this 
application and addresses Examiner's comments below. 

Applicant herein amends claims 1-6, 9-15, 18-23, and 26-33. No claims are deleted 
or added. These changes merely correct ministerial errors such as improper antecedent basis, 
spelling and dependencies. They are believed not to introduce new matter and their entry is 
respectfully requested. In making this amendment, Applicant has not and does not narrow 
the scope of the protection to which Applicant considers the claimed invention to be entitled 
and does not concede that the subject matter of such claims was in fact disclosed or taught by 
the cited prior art. Rather, Applicant reserves the right to pursue additional protection at a 
later point in time. 

Based on the following Remarks, Applicant respectfully requests that Examiner 
reconsider all outstanding rejections, and withdraw them. 

Response to Rejection Under 35 USC 103(a) in View of Chiu and Dietz 

In the 5 th paragraph of the Office Action, Examiner rejects claims 1 through 33 under 
35 U.S.C. § 103(a) as allegedly being unpatentable in view of U.S. Patent No. 5,101,402 to 
Chiu et al. ("Chiu") and U.S. Patent No. 6,651,099 to Dietz et al. ("Dietz"). This rejection is 
respectfully traversed. 

Claim 1 is directed to a method for providing unique identification of monitored 
network data instances flowing across various connections between networked devices. Each 
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unique identification is derived from information contained entirely within an instance of 

network data. As amended, the method recites: 

using a monitoring device to monitor a network data instance flowing across a data 
connection; 

deriving from the data instance certain information which collectively provides a 
unique identification of the network data instance; 

assembling the derived information into an input string for a hash function; and 

using an output string of the hash function as a signature which represents a unique 
identifier of the network data instance. 

Similarly, claim 18 is directed to an apparatus for providing unique identification of 

monitored network data instances flowing across various connections between networked 

devices. With the apparatus, each unique identification is derived from information 

contained entirely within an instance of network data. As amended, the apparatus comprises: 

a monitoring device positioned to monitor a network data instance flowing across a 
data connection; 

a hash function device having an input string and an output string, the input string 
assembled from certain information derived from the network data instance, 
the information collectively providing a unique identification of the network 
data instance; 

wherein the output string is used as a signature which represents a unique identifier of 
the network data instance. 

The claimed invention beneficially provides a signature capable of uniquely 
identifying a network data instance. The signature is capable of uniquely identifying a 
particular data packet as well as a session to which the packet belongs. Example applications 
of a signature include tracking a data instance, identifying duplicates of the data instance 
transmitted along different network connections, and deleting duplicate data reports for the 
data instance. 

As recited in claims 1 and 18, the signature is generated in compressed form as the 
output of a hash function, thereby enabling efficient transmission, storage and lookup of the 
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signature. Neither Chiu nor Dietz, either alone or in combination, disclose, teach, or suggest 
the claimed invention. 

Claim 1, as amended, recites: "using an output string of the hash function as a 
signature which represents a unique identifier of the network data instance." Claim 18, as 
amended, recites: "wherein the output string is used as a signature which represents a unique 
identifier of the network data instance." Applicant agrees with Examiner that Chiu does not 
disclose using the output of a hash function as a signature which represents a unique 
identifier of a network data instance. Moreover, Dietz neither discloses nor suggests this 
feature of claims 1 and 18. 

The cited portions of Dietz are directed to hashing a flow signature to generate a hash. 
Dietz, col. 6, lines 18-19; col. 13, lines 20-23 and 30-36. The hash in Dietz is used for 
"conventional" purposes, namely "to spread flow entries identified by the signature across a 
database for efficient searching." Dietz, col. 13, lines 31-34. Specifically, the hash is used 
merely to locate a signature in a flow entry database. Dietz, col. 14, lines 14-34; col.20, lines 
19-23. As previously explained, the hash in Dietz is functionally distinct from the signature 
recited in claims 1 and 1 8. See Amendment B dated February 22, 2005, pages 10-11. First, 
the hash does not represent "a unique identifier of the network data instance" because Dietz 
uses a flow signature separate from the hash to identify a particular flow entry. Dietz, col. 6, 
lines 18-19; col. 13, lines 20-29; col. 14, lines 39-42; col. 20, lines 18-22. In fact, the hash in 
Dietz is incapable of independently identifying a network data instance. Id. Further, the 
hash in Dietz is not intended to be a unique identifier because more than one flow entries can 
be stored in a bin corresponding to the same hash. Id. The hash in Dietz does not disclose or 
suggest using the output of a hash function as a signature because the hash in Dietz is 
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incapable of uniquely identifying a network data instance. Therefore, neither Dietz nor Chiu 
discloses or suggests a compressed signature that uniquely identifies a network data instance 
while also being capable of efficient transmission, storage and lookup. 

Further, neither Chiu nor Dietz discloses or suggests "a signature which represents a 
unique identifier of the network data instance" (emphasis added) as recited in claims 1 and 
18. The signature recited in claims 1 and 18 is capable of uniquely identifying a particular 
packet as well as a session or flow to which the packet belongs. See Amendment A dated 
May 27, 2004, pages 11-12. However, neither Chiu nor Dietz discloses or suggests a 
signature that is capable of uniquely identifying a particular network data instance such as a 
packet. The cited portions of Chiu merely describe a session key that is used to identify a 
session. Chiu, col. 9, lines 1-9. Similarly, the cited portions of Dietz merely describe a flow 
key that is used to build a flow signature for a flow. Dietz, col. 6, lines 18-19; col. 13, lines 
20-23. Therefore, neither Chiu nor Dietz discloses or suggests a signature that is capable of 
tracking a particular data instance as well as a session or flow. 

As previously recited, claim 33 and the dependent claims recite additional patentable 
features of the claimed invention that are not disclosed or suggested by Chiu or Dietz, either 
alone or in combination. For example, claims 3 and 33 recite transmitting a data report and 
signature from a monitoring device to a central collecting device, while claim 20 recites a 
central collection device that receives the transmitted signature. The cited portions of Chiu 
merely mention a central node that collects information (Chiu, col. 12, lines 7-14); however, 
Chiu does not disclose or suggest transmitting a signature generated using the output of a 
hash function to a central collecting device. To provide another example, Examiner fails to 
identify where, if at all, Chiu or Dietz disclose truncating the signature to include fewer bits 
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as recited in claims 13 and 30. Examiner's unsupported assertion that this feature is obvious 
is unpersuasive because both Chiu and Dietz fail to disclose or suggest a compressed 
signature generated by truncation of a hash function output string. 

In summary, Applicant respectfully requests reconsideration and removal of the basis 
of the reject to claims 1 through 33. Applicant also requests allowance of these claims at this 
time. 



In sum, Applicant respectfully submits that claims 1 through 33, as presented herein, 
are patentably distinguishable over the cited references (including references cited, but not 
applied). Therefore, Applicant requests reconsideration of the basis for the rejections to 
these claims and requests allowance of them. 

In addition, Applicant respectfully invites Examiner to contact Applicant's 
representative at the number provided below if Examiner believes it will help expedite 
furtherance of this application. 



Conclusion 



Respectfully Submitted, 
Leslie V. Niles 



Date: August 3 L 2005 
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